IQSS · srmanda-cs · Aug 1, 2026 · Aug 1, 2026 · srmanda-cs · Aug 1, 2026
diff --git a/src/main/java/edu/harvard/iq/dataverse/api/Access.java b/src/main/java/edu/harvard/iq/dataverse/api/Access.java
@@ -279,6 +279,12 @@ public BundleDownloadInstance datafileBundleWithGuestbookResponse(@Context Conta
     private DataFile findDataFileUserCanSeeOrDieWrapper(String fileId, DataverseRequest req){
 
         DataFile df = null;
+
+        if (req.getUser() instanceof GuestUser) {
+            // For JSF/UI requests, the ContainerRequestContext user can be GuestUser even when the session is authenticated.
+            // Locally FAIR visibility checks rely on the DataverseRequest user, so pull the session-backed request here.
+            req = dvRequestService.getDataverseRequest();
+        }
 // checkAuthorization is a convenience method; it calls the boolean method 
 // isAccessAuthorized(), the actual workhorse, and throws a 403 exception if not. 
 private void checkAuthorization(User initialUser, DataFile df) throws WebApplicationException { 
     User user = getRequestor(initialUser); 
     if (!isAccessAuthorized(user, df)) { 
         throw new ForbiddenException(); 
     }         
 } 
 private User getRequestor(User user) { 
     // CompoundAuthMechanism should find the user by API Key/Token, Workflow, etc. And for SPA the Bearer Token 
     // For JSF check if CompoundAuthMechanism couldn't find the user then try to get it from the session 
     if (session!=null && user instanceof GuestUser) { 
         user = session.getUser(); 
     } 
     return user; 
 } 
 private boolean checkGuestbookRequiredResponse(User user, UriInfo uriInfo, DataFile df, String gbrids) throws WebApplicationException { 
     // Check if guestbook response is required 
     Dataset d = df.getOwner(); 
     boolean required = df.getOwner().hasEnabledGuestbook() && !d.getEffectiveGuestbookEntryAtRequest(); 
     boolean wasWrittenInPost = false; 
     if (required) { 
         User requestor = getRequestor(user); 
         if (requestor instanceof AuthenticatedUser && permissionService.userOn(requestor, df.getOwner()).has(Permission.EditDataset)) { 
             required = false; 
         } 
         // Check if we are downloading a thumbnail image which doesn't require a guestbook response 
         boolean imageThumb = uriInfo.getQueryParameters().containsKey("imageThumb"); 
         if (imageThumb) { 
             required = false; 
         } 
         if (required && gbrids != null && !gbrids.isEmpty()) { 
             try { 
                 // verify that this id is good 
                 GuestbookResponse gbr = guestbookResponseService.findById(Long.valueOf(gbrids)); 
                 if (gbr == null) { 
                     throw new NotFoundException("GuestbookResponse Not Found for id:" + gbrids); 
                 } 
                 Long delta = Instant.now().toEpochMilli() - gbr.getResponseTime().getTime(); 
                 wasWrittenInPost = gbr.getDataset().getId().equals(df.getOwner().getId()) && delta <= (GUESTBOOK_RESPONSE_SIGNEDURL_TIMEOUT_MINUTES * 60000L); 
             } catch (NumberFormatException | DateTimeParseException ex) { 
                 throw new BadRequestException(ex.getMessage()); 
             } 
         } 
     } 
     return required && !wasWrittenInPost; 
 } 
 // checkAuthorization is a convenience method; it calls the boolean method 
 // isAccessAuthorized(), the actual workhorse, and throws a 403 exception if not. 
 private void checkAuthorization(User initialUser, DataFile df) throws WebApplicationException { 
     User user = getRequestor(initialUser); 
     if (!isAccessAuthorized(user, df)) { 
         throw new ForbiddenException(); 
     }         
 } 
 private User getRequestor(User user) { 
     // CompoundAuthMechanism should find the user by API Key/Token, Workflow, etc. And for SPA the Bearer Token 
     // For JSF check if CompoundAuthMechanism couldn't find the user then try to get it from the session 
     if (session!=null && user instanceof GuestUser) { 
         user = session.getUser(); 
     } 
     return user; 
 } 
 private boolean checkGuestbookRequiredResponse(User user, UriInfo uriInfo, DataFile df, String gbrids) throws WebApplicationException { 
     // Check if guestbook response is required 
     Dataset d = df.getOwner(); 
     boolean required = df.getOwner().hasEnabledGuestbook() && !d.getEffectiveGuestbookEntryAtRequest(); 
     boolean wasWrittenInPost = false; 
     if (required) { 
         User requestor = getRequestor(user); 
         if (requestor instanceof AuthenticatedUser && permissionService.userOn(requestor, df.getOwner()).has(Permission.EditDataset)) { 
             required = false; 
         } 
         // Check if we are downloading a thumbnail image which doesn't require a guestbook response 
         boolean imageThumb = uriInfo.getQueryParameters().containsKey("imageThumb"); 
         if (imageThumb) { 
             required = false; 
         } 
  
         if (required && gbrids != null && !gbrids.isEmpty()) { 
             try { 
                 // verify that this id is good 
                 GuestbookResponse gbr = guestbookResponseService.findById(Long.valueOf(gbrids)); 
                 if (gbr == null) { 
                     throw new NotFoundException("GuestbookResponse Not Found for id:" + gbrids); 
                 } 
                 Long delta = Instant.now().toEpochMilli() - gbr.getResponseTime().getTime(); 
                 wasWrittenInPost = gbr.getDataset().getId().equals(df.getOwner().getId()) && delta <= (GUESTBOOK_RESPONSE_SIGNEDURL_TIMEOUT_MINUTES * 60000L); 
             } catch (NumberFormatException | DateTimeParseException ex) { 
                 throw new BadRequestException(ex.getMessage()); 
             } 
         } 
     } 
     return required && !wasWrittenInPost; 
 } 
 
         try {
             df = findDataFileUserCanSeeOrDie(fileId, req);